Versions

8.0.4.84	4.55%
8.0.4.84	22.73%
8.0.4.84	4.55%
8.0.4.73	4.55%
8.0.4.24	4.55%
8.0.4.17	4.55%
8.0.2.155	4.55%
8.0.2.155	4.55%
8.0.2.155	4.55%
8.0.2.127	4.55%
8.0.2.118	4.55%
8.0.2.96	22.73%
8.0.2.96	4.55%
8.0.1.233	4.55%

Warning 10 antivirus scanners has detected malware in various versions of WRSA.exe.

There are 14 versions of wrsa.exe in the wild, the latest version being 8.0.4.84. It is started as a Windows Service with the name 'WRSVC' and described as “Webroot SecureAnywhere Antivirus v8.0.2.118”. . In addition, it is run under the context of the SYSTEM account with extensive privileges (the administrator accounts have the same privileges). During installation, a run registry key for all users is added that will cause the program to run each time any user logs on to Windows. The average file size is about 727.46 KB. The file is a digitally signed and issued to Webroot Inc. by VeriSign. Some variations of the file have been seen to be installed with the program Webroot SecureAnywhere from Webroot. During the process's lifecycle, the typical CPU resource utilization is about 0.0007% including both foreground and background operations, the average private memory consumption is about 42.74 MB. Addionally, typically read and write I/O disk operations is about 3.17 MB per minute for reads and 216.22 KB per minute for writes.

Based on 40+ industry antivirus scanners, 10 of them detected the following malware.